Selective navigation/rename union with the root canvas and palette

Prepared source only, Codex-956atf, root-owned issue 27. The integration worktree is .local/navigation-palette-union-20260913, branch codex/navigation-palette-union-956atf-20260913, based on e44f07565cc7599d5c5a15a6b5599b4f5d105718. No compiler, test, native UI, Gitea write or publication was performed for this candidate. Root's later test-only readonly correction is deliberately left for the integration owner. Peer issue 13 WIP is excluded.

Source provenance

The actual common Git ancestor of root e44 and peer navigation/rename 208 is c6d296a7e22c8f126834a1e217b88551634dd5cf; this preparation therefore imports scoped production deltas instead of replacing the peer tree or merging competing historical records.

cb91525cfd9da7ac15ea1b21b962145c77bb9922: desktop grapheme-aware shortening and direct unicode-segmentation = "1.13.3" dependency. The root lockfile already resolves that version; only oa-desktop's direct dependency list is extended.
7aa007b0777aa182a99f46e90eeb9b2558f3ad2a..46b4f3c0d0f04050ad6d705051ee0199138e47a2: production crate changes comprising bounded source navigation fdf756e6a41b1879760e45c2c263bd671b562fe3 and the exact-identity/visual-focus correction 46b4f3c. Core changes are the bounded tolerant outline and UUID-header-shape APIs, not an analysis schema or codec import.
4db1ef543ced916179194272bf0e65dce73cb107..208268c8aa7f6bc3c2bab6a3c0657358f3f7dc23: the already-composed navigation/rename production crates and language RST/HTML paragraphs. This includes the mandatory cbc49a7802fb1bba0dd284fd904c700a0703ae70 preview-scroll correction, mutual modal guards, exact worker slots, captured action envelopes and Details visit rotation; its raw rename commits are not applied twice.
10bd71197285a4ba894e6ed9398d2c5402ab463d: the exact peer regression correction from expected.project to expected.decoded.project.

The peer's harness/experiments/navigation-rename-union-20260912/README.md, native-acceptance.md, import provenance and final source hashes were read at exact 208. They remain evidence for that source. This candidate does not inherit an execution pass from them.

Composition decisions

The initial navigation patch had conflicts in app.rs, behavior.rs, behavior/topology.rs and views.rs; the rename documentation patch had insertion conflicts in docs/language.{rst,html}. They were resolved as follows:

Keep root allocation dispatch and boundary retirement alongside navigation's first-valid-viewport completion. Stale Rename and stale toolbar-owner envelopes reject before either navigation reconciliation or allocation retirement. Passive allocation KeyboardBoundary/window-unfocus notifications preserve the pending navigation destination; actual allocation actions still pass through navigation retirement. New passive worker completions and stamped viewport events are recognized by allocation's boundary adapter.
Keep keyboard_owner_enabled separate from busy execution admission, root focus_pending and pan/Space keyboard guards, root diagram focus wrappers and the state picker's stable widget slot. A diagram chooser also suspends allocation input ownership. Peer-only panel Focus actions are not imported as an unrelated prerequisite; their two classification arms are omitted from is_navigation_camera because those variants do not exist in the root UI.
Keep typed activations, logical versus clipped correlation, conservative branch termination, no resurrection, lifecycle clearances, palette and guide/backplate/activation/foreground paint order. The behavior renderer gains the label-bounds helper required by actual-Scene navigation, retaining precise-message → activation → label → broad hit priority. Navigation does not create duplicate targets for activation segments.
Keep root stronger preview boundaries while adding the peer's exact selected preview outline. Keep state selected-row outlines, lifecycle glyph colors and all palette foundation/readonly fixes.
Keep the architecture allocation sensor/container identity while attaching stamped navigation measurements. Retain explicit style::source_editor together with the peer's dynamic editor ID and key binding. Preserve stamped Delete confirmations and the allocation feedback layer.
Retain all root numeric, allocation, removal, focus, typed activation and lifecycle modules. No user specification or existing evidence is replaced. The readonly test file remains byte-identical to base e44 for the parent's separate fix.

Correction to the preliminary compatibility audit

The earlier source prediction that port/state-row navigation necessarily leaves an owner placement armed for Delete was incomplete: reveal_diagram_usage ends by calling root refresh_draft, which normalizes both authoring placement fields for those semantic targets. Peer tests already assert this normalization. That predicted defect is not established and no selection rewrite was made. New mounted navigation-to-removal tests protect this actual composition, including confirmation and whole-source/model history.

The parent reviewed the main paint/focus/dispatch composition and identified an additional stale-toolbar seam. The resulting early Scope check and regression are included. This is a source review checkpoint, not runtime acceptance.

New regression membership, all unrun

Three source/App tests under app::source_rename::tests::navigation_union_tests::palette_union:::

allocation_keyboard_notification_preserves_navigation_and_first_measurement
stale_rename_begin_cannot_retire_allocation_epoch_or_new_navigation
captured_behavior_toolbar_cannot_retire_a_new_documents_navigation

They use the peer's actual four-file Unicode/CRLF source fixture, independently delivered lookup completions, captured intent and actual App update path. They check accepted snapshot identity, allocation epoch, exact navigation identity and the first valid viewport. No worker Tasks are polled by these source tests.

Two mounted tests under app::diagram_removal_tests::navigation_union:::

port_navigation_then_canvas_delete_preserves_owner_and_restores_exact_history
state_row_navigation_then_canvas_delete_preserves_work_and_restores_exact_history

They complete the real usage query, mount the production App tree, focus the real canvas with its public widget operation, capture actual Delete and Shift-Delete intents, cancel once, confirm the exact semantic target, compare the result with the core Delete command, and Undo to the full original Project/SourceBundle. They neither seed private canvas focus nor fabricate a removal intent.

The published navigation union's original six App tests and four retained-widget preview-scroll tests remain. The broader navigation_union_tests:: prefix now contains nine tests because of the three nested additions; the new palette_union:: filter alone selects three. The removal union filter selects two. Keep original coverage, source navigation/query/outline, alias-rename/document, diagram usage/reveal, root allocation/removal/focus, style and activation/lifecycle suites in the combined gates.

Performed checks and remaining acceptance

Only source inspection, bounded formatting and whitespace checks are performed here. Rustfmt 1.9.0-stable (48a229ceae 2026-09-01) was invoked with edition 2024 and skip_children=true on the 67 changed/new Rust paths, excluding the root readonly test. The first unqualified formatter attempt did not launch because the executable was absent from this shell PATH; its stale shell exit value is explicitly corrected in the ignored receipt. The second attempt uses the resolved toolchain from the parent's absolute .local/toolchain/env.ps1. Ignored import patches and formatting receipts are retained at .local/navigation-import in this worktree.

No cargo, rustc, test binary or GUI was run. Compile/lint correctness, new test outcomes, timing and actual native usability remain open. The integration owner should run focused new filters first, retain existing grouped/full/strict gates and build the matching executable. The parent's e44 results do not validate this union.

Native acceptance retains the peer's six-file examples/source-project oracle: rename the second @assess_report reference to assess_report_union, exactly six alias-token changes in two files, no disk change before Save, immediate editor selection/typing and text Undo, navigation without model history, complete model Undo/Redo, then Save/reopen equality. Also exercise actual overflowing preview/Details return, modal exclusivity, source syntax selection, canvas focus/Delete after navigation, exact port/state-row and repeated-placement targets, nested activation shoulders/lifecycle boundaries, and passive event timing. Use deterministic race tests for held operations; screenshots alone do not establish ordering. Linux remains deferred.

Independent-review correction after 4e51, source only

The independent review of 4e51d68973da52cf057fab4983b9f112400b802c identified an actual dispatch-order defect: old source, chooser and allocation envelopes reached shared reveal/allocation boundaries before their handlers rejected them. The follow-up shares those existing admission checks with the outer App boundary. SourceSymbols retains session/path checks; Find-close retains context/instance/open/availability checks and maps to the legacy Close only inside the checked handler. DiagramUsage retains exact Open document/revision/subject checks and all seven panel-token checks. Cancel, Preview and Release retain the active gesture token check; Refused retains its epoch check. Worker completion handlers and their exact occupied-slot release remain unchanged.

Rejected Press packets still run their existing feedback handler, before shared boundaries, so an old stamp can explain the changed view without consuming a newer destination. Current gestures, current chooser actions and current Find-close remain active. Current-token chooser model-refresh recovery is retained; this change does not require a matching panel revision before its existing refresh handler can run. No selection rewrite or broader event classification is introduced.

The exact test-only peer correction a49b0ec7ac4538a372139175386a881645c1a59e was inspected and applied: two collapsed conditions and one range containment expression in app/diagram_usages/tests.rs and behavior/scenario/usage/tests.rs. A source sweep also supplies the newly required navigation_focus: None in the root allocation test canvas and the production dirty-point-only canvas in allocation_input.rs. The latter is used only for the dirty-work hit check, not painted.

Four further tests under app::source_rename::tests::navigation_union_tests::palette_union::, all unrun:

captured_old_source_query_and_find_close_preserve_the_new_destination
current_source_query_and_checked_find_close_remain_live
captured_old_chooser_context_and_every_token_variant_are_inert
current_chooser_open_and_close_keep_their_boundary_and_worker_semantics

They capture actual prior owners/tokens and check complete navigation, allocation epoch, source interaction, status and accepted snapshot retention; each rejected navigation case then completes the valid pending viewport. Positive controls exercise current source query/Find-close and current chooser boundaries, including close while its worker slot remains occupied and exact completion release.

Two further tests under app::allocation_drag::tests::navigation_union::, all unrun:

stale_gesture_packets_preserve_navigation_and_a_new_live_cancel_still_works
old_chooser_envelopes_preserve_a_current_canvas_gesture

They capture Press through the actual DiagramCanvas event path, navigate through the actual chooser, preserve camera/selection/focus/pending measurement and the newer active gesture across stale packets, retain invalid-Press feedback, and exercise current Cancel and current chooser retirement. They do not seed private active gesture state. The resulting palette_union:: filter contains seven tests, its enclosing navigation_union_tests:: contains thirteen, the separate removal union still contains two, and the new allocation union contains two. The four existing preview-scroll tests are retained.

Only bounded rustfmt and whitespace/source checks are performed for this follow-up; the ignored formatting receipt is .local/navigation-import/stale-envelope-format.json. All new tests, compilation, strict lint and native acceptance remain unrun here. Root readonly, typed activation/lifecycle and paint implementations are untouched by this follow-up. The integration owner must execute the combined source gates; neither source review nor peer-only passes establishes union acceptance.

13 KiB Raw Blame History